CVE-2026-78449: RMCAST Driver Use-After-Free Vulnerability

CVE-2026-78449 Overview

CVE-2026-78449 is a use-after-free vulnerability [CWE-416] in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthorized remote attacker can trigger the flaw to execute arbitrary code over a network. The kernel-mode driver mishandles object lifetime on multicast message processing paths, creating a dangling pointer that can be reclaimed by attacker-controlled data. Successful exploitation grants code execution in the context of the vulnerable driver, which typically operates at high privilege.

Critical Impact
Remote, unauthenticated attackers who can reach the RMCAST driver over the network can execute code with kernel-level privileges, enabling full system compromise.

Affected Products

Microsoft Windows (Reliable Multicast Transport Driver / RMCAST component)
Refer to the Microsoft Security Update CVE-2026-78449 advisory for the authoritative list of affected Windows builds

Discovery Timeline

2026-09-08 - CVE-2026-78449 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78449

Vulnerability Analysis

The vulnerability resides in the Reliable Multicast Transport Driver (RMCAST), a Windows kernel component that implements the Pragmatic General Multicast (PGM) protocol. RMCAST manages session state, retransmission windows, and receiver buffers for multicast traffic. A use-after-free condition occurs when the driver releases an internal object while another code path retains and dereferences a stale pointer to it. Attackers who send crafted multicast packets can influence the allocator to reoccupy the freed region with controlled data. Dereferencing the stale pointer then redirects execution flow inside the kernel.

Exploitation is network-based and requires no privileges or user interaction, though the attack complexity is high because the attacker must win a timing window and shape kernel heap state remotely. Successful exploitation results in code execution within the kernel, breaking process isolation and security boundaries.

Root Cause

The root cause is improper object lifetime management [CWE-416] inside RMCAST. A reference to a session or buffer object is used after the object has been freed, most likely due to a missing lock, incorrect reference count decrement, or a race between packet processing and cleanup routines.

Attack Vector

An unauthenticated attacker sends specially crafted PGM multicast packets to a system running the vulnerable RMCAST driver. Environments that permit inbound multicast traffic, such as media distribution, market data feeds, or message-queuing deployments, are directly exposed. See the Microsoft Security Update CVE-2026-78449 advisory for protocol and configuration details.

No public proof-of-concept code is available at the time of publication, and no verified exploitation code is included in this article.

Detection Methods for CVE-2026-78449

Indicators of Compromise

Unexpected inbound PGM multicast traffic (IP protocol 113) to hosts that do not normally consume multicast feeds
Kernel bugchecks or SYSTEM_SERVICE_EXCEPTION / DRIVER_IRQL_NOT_LESS_OR_EQUAL crashes referencing rmcast.sys
New or unexplained kernel-mode processes, threads, or drivers appearing after multicast traffic bursts
Anomalous outbound connections from System process shortly after receipt of multicast packets

Detection Strategies

Enable Windows Event Log forwarding for kernel crash events (Event IDs 1001, 41) and correlate against network telemetry
Alert on inbound traffic to UDP/PGM multicast ports on hosts that are not designated multicast subscribers
Deploy behavioral endpoint detection to flag kernel-mode memory corruption patterns and unexpected loads of drivers following network activity

Monitoring Recommendations

Monitor for repeated crashes of rmcast.sys across the fleet, which may indicate exploitation attempts or reliability probes
Baseline multicast traffic per segment and alert on deviations in packet size, rate, or source diversity
Ingest firewall and NetFlow logs into a centralized analytics platform to identify lateral multicast probing

How to Mitigate CVE-2026-78449

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-78449 advisory as soon as testing permits
Inventory Windows systems that load rmcast.sys and prioritize patching internet-exposed and multicast-enabled hosts
Restrict inbound PGM multicast traffic at network boundaries and host firewalls where the protocol is not required

Patch Information

Microsoft has published a security update addressing the use-after-free condition in RMCAST. Refer to the Microsoft Security Update CVE-2026-78449 advisory for the specific KB articles, build numbers, and installation guidance corresponding to each supported Windows version.

Workarounds

Disable the Windows Message Queuing (MSMQ) service if it is not required, since MSMQ commonly enables PGM multicast processing
Block inbound IP protocol 113 (PGM) at perimeter firewalls and internal segmentation points
Use Windows Defender Firewall rules to restrict RMCAST endpoints to trusted multicast sources only

bash

# Configuration example: block inbound PGM (IP protocol 113) on Windows
netsh advfirewall firewall add rule name="Block Inbound PGM (CVE-2026-78449)" ^
  dir=in action=block protocol=113

# Optional: disable Message Queuing if unused
Dism /Online /Disable-Feature /FeatureName:MSMQ-Container /NoRestart